Add Circom not-so-smart-contracts

[omarinuwa]

Summary

• Adds 5 Circom-specific vulnerability entries covering the most common ZK circuit pitfalls found in security audits
• New entries: Unconstrained Signal Assignments, Field Overflow Aliasing, Unconstrained Component Outputs, Missing Input Constraints, Unsafe Arithmetic Edge Cases
• Includes index README and navigation updates (SUMMARY.md, root README, not-so-smart-contracts README)

Why a standalone section?

Circom is placed as its own platform section (like Cairo, Solana, etc.) rather than under the existing Cryptography section. Circom has enough language-specific pitfalls — <-- vs <== assignment semantics, the R1CS constraint model, assert not producing constraints, and circomlib component output/input patterns — to warrant standalone treatment. This is similar to how Cairo has its own section despite being related to the EVM.

The existing Cryptography entry "Underconstrained ZK Circuits" covers the general concept at a protocol level. These Circom entries cover the DSL-specific ways developers accidentally produce underconstrained circuits.

Entries

Vulnerability	Description
Unconstrained Signal Assignments	<-- and assert do not produce R1CS constraints, leaving signals prover-controlled
Field Overflow Aliasing	Full-field-width bit decompositions allow aliased values to bypass range checks
Unconstrained Component Outputs	Comparison component outputs computed but never constrained to expected values
Missing Input Constraints	Templates assume boolean or range properties on inputs without enforcing them
Unsafe Arithmetic Edge Cases	Division by zero, modular inverse semantics, and signed comparison pitfalls

Test plan

• Verify all internal links resolve correctly
• Confirm entries follow the standard format (H1 title, description, H2 Example, H2 Mitigations)
• Review Circom code examples for technical accuracy

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}